Cherry-pick #24488 to 7.12: [Filebeat] Add Dashboards to Threat Intel Module

[marc-gr]

Cherry-pick of PR #24488 to 7.12 branch. Original message:

What does this PR do?

This PR adds a saved search, visualizations, and dashboards for the Threat Intel Filebeat Module.

Why is it important?

The overview dashboard provides valuable information on the health of the module, what type of data is being ingested, how much, and allows you to analyze module metrics.

The additional five dashboards provide a view into the different feeds and allow an analyst to hunt and find connections and associations that may not have previously been exposed.

Checklist

• My code follows the style guidelines of this project
• I have commented my code, particularly in hard-to-understand areas
• I have made corresponding changes to the documentation
• I have made corresponding change to the default configuration files
• I have added tests that prove my fix is effective or that my feature works
• I have added an entry in CHANGELOG.next.asciidoc or CHANGELOG-developer.next.asciidoc.

Author's Checklist

• Validated that ./filebeat setup imports the saved search, visualization, and dashboard
• Validated that data provided by the Threat Intel Filebeat module populates the dashboards

How to test this PR locally

This can be tested by:

cd beats/x-pack/filebeat
mage update && mage build
./filebeat modules enable threatintel
# if using Elastic Cloud, update filebeat.yml to cloud.id and cloud.auth
./filebeat setup -E setup.dashboards.directory=./build/kibana
./filebeat

Go to KIbana -> dashboards -> apply the threat intel tag

Related issues

Resolves #24487

Use cases

Threat hunting, security operations, and intelligence analysis.

Screenshots

Threat Intel Overview

Threat Intel Abuse Malware

Threat Intel Abuse URL

Threat Intel AlienVault OTX

Threat Intel Anomali Limo

Threat Intel MISP

Logs

[elasticmachine]

Pinging @elastic/security-external-integrations (Team:Security-External Integrations)

[botelastic]

This pull request doesn't have a Team:<team> label.

[elasticmachine]

💚 Build Succeeded

the below badges are clickable and redirect to their specific view in the CI or DOCS

Expand to view the summary

Build stats

• Build Cause: Pull request #24578 opened

• Start Time: 2021-03-17T08:59:57.114+0000

• Duration: 47 min 33 sec

• Commit: 01dfff0

Test stats 🧪

Test	Results
Failed	0
Passed	13023
Skipped	2229
Total	15252

Trends 🧪

💚 Flaky test report

Tests succeeded.

Expand to view the summary

Test stats 🧪

Test	Results
Failed	0
Passed	13023
Skipped	2229
Total	15252

[P1llus]

LGTM